TrustManagerFactory relies on default

[akwick]

I am reaching out to you as we conducted an empirical study to understand the nature of cryptographic misuses in enterprise-driven projects on GitHub. During our study, we randomly inspected a few of the misuses. One of the misuses for which we could confirm the finding of the analysis, CogniCryptSAST is within this project.

• HttpClientInit: The implementation in line 143 calls the method TrustManagerFactory.getDefaultAlgorithm() that relies on defaults and can be altered at runtime JCA. Thus, analyses like CogniCryptSAST consider these usages as insecure as the used TrustManager may be insecure.

We hope that this report helps you and would be glad to get your thoughts on this issue.